MS-102 Practice Test 20 — 15 Questions

Question 1

Your organization has a Microsoft 365 tenant with a custom domain contoso.com. You have configured Exchange Online to accept emails for contoso.com. You now need to add a subdomain sales.contoso.com and ensure that email sent to sales.contoso.com is delivered to a specific shared mailbox. What should you do?

Accepted Answer

Add sales.contoso.com as an accepted domain in Exchange Online and create a transport rule to redirect emails to the shared mailbox.. Option B is correct because to route email for a subdomain to a specific mailbox, you must first add the subdomain as an accepted domain in Exchange Online (not as a custom domain in the admin center, since the parent domain is already verified). Then, you create a transport rule that matches recipients in that accepted domain and redirects the messages to the target shared mailbox. This ensures that all emails sent to sales.contoso.com are delivered to the designated mailbox without requiring additional MX records or domain verification.

Answer

Add sales.contoso.com as a custom domain in the Microsoft 365 admin center and verify ownership.

Answer

Configure an auto-expanding archive for the shared mailbox.

Answer

Create a distribution group named sales@contoso.com and add the shared mailbox as a member.

Question 2

You manage a Microsoft 365 tenant for a multinational corporation. You need to implement Microsoft Purview Information Protection to automatically classify and protect documents containing credit card numbers. The solution must apply encryption automatically when a document is saved to SharePoint Online. What should you do?

Accepted Answer

Create an auto-labeling policy in Microsoft Purview that uses a sensitivity label configured with encryption.. Option B is correct because auto-labeling policies in Microsoft Purview can scan documents for sensitive information types (e.g., credit card numbers) and automatically apply a sensitivity label with encryption. Option A is wrong because DLP policies can block sharing but do not label documents. Option C is wrong because the client-side labeling requires user interaction. Option D is wrong because the default label applies to all documents without specific conditions.

Answer

Create a DLP policy in Microsoft Purview that blocks sharing of documents containing credit card numbers.

Answer

Configure client-side labeling via Microsoft 365 Apps to prompt users to label documents.

Answer

Set a default sensitivity label for SharePoint Online document libraries.

Question 3

You are reviewing a Conditional Access policy in Microsoft Entra ID. The exhibit shows the policy configuration. You need to allow users to access Office 365 applications from personal devices that are not enrolled in Microsoft Intune. However, the policy currently blocks access because it requires a compliant device. Users are prompted for MFA but then blocked due to device compliance. What should you modify in the policy?

Accepted Answer

Remove "compliantDevice" from the builtInControls grant control list.. Option C is correct because the policy requires both MFA and compliant device (grantControls). To allow access from non-compliant devices, you can remove the compliantDevice requirement and only require MFA. Alternatively, you can add an exception for personal devices, but modifying the grant controls is straightforward. Option A is wrong because changing session controls does not affect grant requirements. Option B is wrong because cloud app security is a session control, not a grant control. Option D is wrong because sign-in frequency is a session control.

Answer

Add a session control for sign-in frequency.

Answer

Remove the cloudAppSecurity session control.

Answer

Change cloudAppSecurityType to "blockDownloads".

Question 4

Your organization uses Microsoft 365 Business Premium. You need to ensure that all Windows 10 devices are enrolled in Microsoft Intune and comply with a device compliance policy that requires BitLocker encryption and a minimum OS version. What should you do first?

Accepted Answer

Configure automatic enrollment in Microsoft Entra ID for Windows 10 devices.. To enforce Intune compliance policies on Windows 10 devices, the devices must first be enrolled in Intune. Automatic enrollment in Microsoft Entra ID (formerly Azure AD) is the prerequisite step that enables Windows 10 devices to automatically enroll in Intune when they join or are registered with Entra ID. Without this enrollment configured, no Intune policies—including compliance policies—can be applied to the devices.

Answer

Install the Intune Connector for Active Directory on a domain controller.

Answer

Deploy a configuration profile to enable BitLocker.

Answer

Create a device compliance policy in Microsoft Intune.

Question 5

Your organization is planning to migrate from on-premises Exchange to Exchange Online. You need to choose a migration strategy. Which TWO statements about migration methods are correct?

Accepted Answer

A minimal hybrid deployment allows you to manage mailboxes in both on-premises and Exchange Online.. Options A and D are correct. Option A: Minimal hybrid is a valid migration approach. Option D: Cutover migration is for fewer than 2000 mailboxes. Option B is wrong because staged migration not supported for Exchange 2019. Option C is wrong because IMAP migration does not migrate calendar data. Option E is wrong because hybrid migration requires AD synchronization.

Answer

A hybrid migration requires that you do not synchronize on-premises Active Directory with Microsoft Entra ID.

Answer

A staged migration can be used to migrate mailboxes from Exchange 2019 to Exchange Online.

Answer

An IMAP migration migrates email, contacts, and calendar data.

Question 6

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a custom Line-of-Business (LOB) app to a group of devices. The app is not in the Microsoft Store. What is the recommended method to deploy the app?

Accepted Answer

Upload the app package to Intune as a Line-of-Business app and assign it to the device group.. Option D is correct because Intune natively supports deploying custom Line-of-Business (LOB) apps by uploading the app package (e.g., .msi, .exe, .appx) directly into the Intune console and assigning it to a device group. This method is the recommended approach for apps not available in the Microsoft Store, as it leverages Intune's mobile device management (MDM) capabilities to push the app to Windows 10 devices without requiring external infrastructure like Group Policy or the Microsoft Store for Business.

Answer

Add the app as a Microsoft Store app (business) in Intune.

Answer

Use Group Policy to deploy the app via a network share.

Answer

Publish the app to the Microsoft Store for Business and assign it.

Question 7

Your organization uses Microsoft Defender for Cloud Apps. You need to create a policy that automatically blocks downloads of files containing sensitive information from SharePoint Online to unmanaged devices. What type of policy should you create?

Accepted Answer

Session policy. Session policies in Defender for Cloud Apps can monitor and control user sessions in real-time, including blocking downloads based on content inspection. Option A is wrong because file policies are for alerts and governance actions on files at rest. Option B is wrong because activity policies trigger on events but do not control sessions. Option D is wrong because this is a broader tool, not a specific policy type for this scenario.

Answer

Microsoft Purview Data Loss Prevention policy

Answer

Activity policy

Answer

File policy

Question 8

You are the Microsoft 365 administrator for a large enterprise. You need to ensure that only users with a valid business justification can access sensitive data stored in SharePoint Online. The solution must enforce access reviews and provide detailed reports for auditors. Which TWO actions should you take?

Accepted Answer

Configure access reviews in Microsoft Entra ID Governance for the SharePoint site.. Option A is correct because access reviews in Microsoft Entra ID Governance allow you to require users to attest to their continued need for access. Option C is correct because enabling audit logging in Microsoft Purview captures all access events and generates reports for auditors. Option B is wrong because Microsoft Defender for Cloud Apps is for cloud access security broker (CASB) capabilities, not directly for access reviews. Option D is wrong because sensitivity labels are for classification and protection, not access reviews. Option E is wrong because data loss prevention (DLP) policies prevent data exfiltration but do not perform access reviews.

Answer

Deploy Microsoft Defender for Cloud Apps and create a session policy to monitor access.

Answer

Apply a sensitivity label to the SharePoint site and require justification for label change.

Answer

Create a data loss prevention (DLP) policy to block unauthorized sharing.

Question 9

You need to configure Microsoft Teams to allow external access for federation with another organization. The other organization uses a different domain. Which setting must you enable in the Teams admin center?

Accepted Answer

External access with the domain of the other organization.. Option D is correct because to enable federation with another organization that uses a different domain, you must configure External access (also known as federation) in the Teams admin center. Specifically, you need to add the external domain to the allowed domain list under Teams > External access. This allows users in your tenant to communicate with users in the other organization via Teams, using the Session Initiation Protocol (SIP) federation protocol.

Answer

Network roaming policy for the external users.

Answer

Guest access in Teams settings.

Answer

Emergency calling policies.

Question 10

A user reports that they cannot access their Microsoft 365 mailbox from the Outlook desktop client, but they can access it via Outlook on the web. Other users in the same tenant are not experiencing issues. What is the most likely cause?

Accepted Answer

The user's Outlook profile is corrupted or needs to be re-created.. If a user can access via OWA but not Outlook desktop, it often indicates an authentication or client configuration issue rather than a service outage. Disabled MFA would affect both. A service incident would affect many users. License issues would also affect OWA. The most likely cause is that the user's profile is corrupted or authentication token has expired.

Answer

There is a service incident affecting only the Outlook desktop client.

Answer

The user's account has been disabled.

Answer

The user's Microsoft 365 license has expired.

Question 11

Your organization is deploying Windows 11 using Microsoft Intune. You need to ensure that devices are automatically enrolled in Intune when users sign in with their Microsoft Entra ID credentials. Which THREE prerequisites must be met?

Accepted Answer

Microsoft Entra ID P1 or P2 license.. Option C is correct because Microsoft Entra ID P1 or P2 licenses are required to enable automatic MDM enrollment via Intune. Without these licenses, the MDM authority cannot be set to Intune, and the automatic enrollment policy in Microsoft Entra ID will not function. This licensing requirement ensures that the tenant has the necessary features for conditional access and device management policies.

Answer

Devices must run Windows 10/11 Home edition.

Answer

Microsoft Configuration Manager must be deployed.

Question 12

You are configuring Microsoft Purview Information Protection for your tenant. You need to ensure that documents containing credit card numbers are automatically labeled as 'Highly Confidential' and encrypted. Which two components must you configure?

Accepted Answer

A sensitive info type for credit card numbers.. Sensitive info types detect credit card numbers, and auto-labeling policies apply the label and encryption automatically. Option A is wrong because DLP policies alert but don't label. Option B is wrong because retention labels are for retention, not classification. Option D is wrong because the sensitivity label must be published first.

Answer

A data loss prevention (DLP) policy.

Answer

A retention label.

Question 13

You need to ensure that only users from your organization's on-premises Active Directory can access Microsoft 365 services. You have Microsoft Entra Connect configured. What is the simplest way to prevent cloud-only user accounts from signing in?

Accepted Answer

Set the 'Block sign in' option to 'Yes' for all cloud-only users in the Microsoft Entra admin center.. Blocking cloud sign-in for cloud-only users through the user's Sign-in settings directly prevents them from accessing services. Option B is wrong because removing licenses doesn't block sign-in, only access to services. Option C is wrong because disabling the user is a manual process and not scalable. Option D is wrong because this would block all users.

Answer

Configure a conditional access policy that blocks all users.

Answer

Delete the cloud-only users from Microsoft Entra ID.

Answer

Remove all licenses from cloud-only users.

Question 14

You are implementing Microsoft Purview Data Lifecycle Management. You need to retain all emails for a minimum of 5 years but automatically delete them after 7 years. Which TWO actions should you configure?

Accepted Answer

Create a retention policy with 'Delete items after 7 years'.. A retention tag with 'Keep for 5 years' and a retention policy with 'Delete after 7 years' together define a minimum retention of 5 years and maximum of 7 years. Option C is wrong because litigation hold prevents deletion. Option D is wrong because this is not related to retention. Option E is wrong because MRM policies are for on-premises, not Purview.

Answer

Use Messaging Records Management (MRM) retention policies.

Answer

Configure a sensitivity label for the emails.

Answer

Place the mailbox on litigation hold.

Question 15

You are a Microsoft 365 administrator for a small business with 50 users. The company uses Microsoft 365 Business Premium. You need to ensure that all users have multi-factor authentication (MFA) enabled. The company does not have any custom conditional access policies. You want to implement MFA as quickly as possible with minimal configuration. What should you do?

Accepted Answer

Enable security defaults in the Microsoft Entra admin center.. Security defaults provide a pre-configured set of security policies, including requiring MFA for all users, that can be enabled with a single toggle in the Microsoft Entra admin center. This is the fastest and simplest method for a small business with no existing conditional access policies, as it requires minimal configuration and immediately enforces MFA for every user.

Answer

Configure MFA registration campaign for all users.

Answer

Enable per-user MFA for each user.

Answer

Create a conditional access policy that requires MFA for all users.